

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=auto>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/fluid.png">
  <link rel="icon" href="/img/favicon.ico">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="author" content="xuehaoweng">
  <meta name="keywords" content="">
  
    <meta name="description" content="本文将介绍如何将 Python 项目的日志接入到 ELK（Elasticsearch、Logstash 和 Kibana）这一流行的日志管理平台。我们将详细讨论如何使用 Filebeat 进行日志收集，并通过 Logstash 解析 Python 日志，并将其存储在 Elasticsearch 中，最后使用 Kibana 进行可视化展示。   简介ELK 是一个开源的日志管理平台，它可以帮助开">
<meta property="og:type" content="article">
<meta property="og:title" content="如何将Python项目日志接入到ELK">
<meta property="og:url" content="http://blog.xhweng.cn/2025/02/11/%E5%A6%82%E4%BD%95%E5%B0%86Python%E9%A1%B9%E7%9B%AE%E6%97%A5%E5%BF%97%E6%8E%A5%E5%85%A5%E5%88%B0ELK/index.html">
<meta property="og:site_name" content="有追求的开发者">
<meta property="og:description" content="本文将介绍如何将 Python 项目的日志接入到 ELK（Elasticsearch、Logstash 和 Kibana）这一流行的日志管理平台。我们将详细讨论如何使用 Filebeat 进行日志收集，并通过 Logstash 解析 Python 日志，并将其存储在 Elasticsearch 中，最后使用 Kibana 进行可视化展示。   简介ELK 是一个开源的日志管理平台，它可以帮助开">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://blog.xhweng.cn/img/file_img/telemetry.png">
<meta property="article:published_time" content="2025-02-11T03:03:00.000Z">
<meta property="article:modified_time" content="2025-02-11T03:03:44.806Z">
<meta property="article:author" content="xuehaoweng">
<meta property="article:tag" content="框架">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="http://blog.xhweng.cn/img/file_img/telemetry.png">
  
  
    <meta name="referrer" content="no-referrer-when-downgrade">
  
  
  <title>如何将Python项目日志接入到ELK - 有追求的开发者</title>

  <link  rel="stylesheet" href="https://lib.baomitu.com/twitter-bootstrap/4.6.1/css/bootstrap.min.css" />



  <link  rel="stylesheet" href="https://lib.baomitu.com/github-markdown-css/4.0.0/github-markdown.min.css" />

  <link  rel="stylesheet" href="https://lib.baomitu.com/hint.css/2.7.0/hint.min.css" />

  <link  rel="stylesheet" href="https://lib.baomitu.com/fancybox/3.5.7/jquery.fancybox.min.css" />



<!-- 主题依赖的图标库，不要自行修改 -->
<!-- Do not modify the link that theme dependent icons -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_hj8rtnfg7um.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_lbnruvf0jn.css">


<link  rel="stylesheet" href="/css/main.css" />


  <link id="highlight-css" rel="stylesheet" href="/css/highlight.css" />
  
    <link id="highlight-css-dark" rel="stylesheet" href="/css/highlight-dark.css" />
  




  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    Fluid.ctx = Object.assign({}, Fluid.ctx)
    var CONFIG = {"hostname":"blog.xhweng.cn","root":"/","version":"1.9.7","typing":{"enable":true,"typeSpeed":70,"cursorChar":"_","loop":false,"scope":[]},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"left","visible":"hover","icon":""},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"code_language":{"enable":true,"default":"TEXT"},"copy_btn":true,"image_caption":{"enable":true},"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"placement":"right","headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":0},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":true,"follow_dnt":true,"baidu":"b3bbb822b3d2a5e2761107c03cf72b8c","google":{"measurement_id":null},"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":null,"app_key":null,"server_url":null,"path":"window.location.pathname","ignore_local":false}},"search_path":"/local-search.xml","include_content_in_search":true};

    if (CONFIG.web_analytics.follow_dnt) {
      var dntVal = navigator.doNotTrack || window.doNotTrack || navigator.msDoNotTrack;
      Fluid.ctx.dnt = dntVal && (dntVal.startsWith('1') || dntVal.startsWith('yes') || dntVal.startsWith('on'));
    }
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
  

  
    <!-- Baidu Analytics -->
    <script async>
      if (!Fluid.ctx.dnt) {
        var _hmt = _hmt || [];
        (function() {
          var hm = document.createElement("script");
          hm.src = "https://hm.baidu.com/hm.js?b3bbb822b3d2a5e2761107c03cf72b8c";
          var s = document.getElementsByTagName("script")[0];
          s.parentNode.insertBefore(hm, s);
        })();
      }
    </script>
  

  
    <!-- Google tag (gtag.js) -->
    <script async>
      if (!Fluid.ctx.dnt) {
        Fluid.utils.createScript("https://www.googletagmanager.com/gtag/js?id=", function() {
          window.dataLayer = window.dataLayer || [];
          function gtag() {
            dataLayer.push(arguments);
          }
          gtag('js', new Date());
          gtag('config', '');
        });
      }
    </script>
  

  

  

  

  



  
<meta name="generator" content="Hexo 7.0.0"></head>


<body>
  

  <header>
    

<div class="header-inner" style="height: 70vh;">
  <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>有追求的开发者</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/" target="_self">
                <i class="iconfont icon-home-fill"></i>
                <span>首页</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/" target="_self">
                <i class="iconfont icon-archive-fill"></i>
                <span>归档</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/" target="_self">
                <i class="iconfont icon-category-fill"></i>
                <span>分类</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/" target="_self">
                <i class="iconfont icon-tags-fill"></i>
                <span>标签</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/" target="_self">
                <i class="iconfont icon-user-fill"></i>
                <span>关于</span>
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              <i class="iconfont icon-search"></i>
            </a>
          </li>
          
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">
              <i class="iconfont icon-dark" id="color-toggle-icon"></i>
            </a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

  

<div id="banner" class="banner" parallax=true
     style="background: url('/img/default.png') no-repeat center center; background-size: cover;">
  <div class="full-bg-img">
    <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
      <div class="banner-text text-center fade-in-up">
        <div class="h2">
          
            <span id="subtitle" data-typed-text="如何将Python项目日志接入到ELK"></span>
          
        </div>

        
          
  <div class="mt-3">
    
    
      <span class="post-meta">
        <i class="iconfont icon-date-fill" aria-hidden="true"></i>
        <time datetime="2025-02-11 11:03" pubdate>
          2025年2月11日 上午
        </time>
      </span>
    
  </div>

  <div class="mt-1">
    
      <span class="post-meta mr-2">
        <i class="iconfont icon-chart"></i>
        
          1.3k 字
        
      </span>
    

    
      <span class="post-meta mr-2">
        <i class="iconfont icon-clock-fill"></i>
        
        
        
          11 分钟
        
      </span>
    

    
    
  </div>


        
      </div>

      
    </div>
  </div>
</div>

</div>

  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="side-col d-none d-lg-block col-lg-2">
      

    </div>

    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div id="board">
          <article class="post-content mx-auto">
            <h1 id="seo-header">如何将Python项目日志接入到ELK</h1>
            
            
              <div class="markdown-body">
                
                <blockquote>
<blockquote>
<p>本文将介绍如何将 Python 项目的日志接入到 ELK（Elasticsearch、Logstash 和 Kibana）这一流行的日志管理平台。我们将详细讨论如何使用 Filebeat 进行日志收集，并通过 Logstash 解析 Python 日志，并将其存储在 Elasticsearch 中，最后使用 Kibana 进行可视化展示。</p>
</blockquote>
</blockquote>
<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>ELK 是一个开源的日志管理平台，它可以帮助开发人员更好地监控和管理应用程序的日志。ELK 由三个组件组成：Elasticsearch、Logstash 和 Kibana。</p>
<p><strong>Elasticsearch</strong> 是一个实时的分布式搜索和分析引擎，它可以用于全文搜索，结构化搜索以及分析。它是一个建立在全文搜索引擎 Apache Lucene 基础上的搜索引擎，使用 Java 语言编写。</p>
<p><strong>Logstash</strong> 是一个具有实时渠道能力的数据收集引擎，主要用于日志的收集与解析，并将其存入 ElasticSearch 中。</p>
<p><strong>Kibana</strong> 是一款基于 Apache 开源协议，使用 JavaScript 语言编写，为 Elasticsearch 提供分析和可视化的 Web 平台。它可以在 Elasticsearch 的索引中查找，交互数据，并生成各种维度的表图。</p>
<p><strong>Filebeat</strong> 是一个轻量级的数据传送工具，主要用于转发和集中日志数据。它是 ELK（Elasticsearch、Logstash、Kibana）日志系统中的一个组件，尤其擅长于收集和转发日志事件。Filebeat 监视您指定的日志文件或位置，收集日志事件，并将它们转发到 Elasticsearch 或 Logstash 进行索引。引入 Filebeat 作为日志搜集器，主要是为了解决 Logstash 开销大的问题。相比 Logstash，Filebeat 所占系统的 CPU 和内存几乎可以忽略不计。</p>
<h2 id="常规-ELK-架构"><a href="#常规-ELK-架构" class="headerlink" title="常规 ELK 架构"></a>常规 ELK 架构</h2><p><img src="https://files.mdnice.com/user/33721/c704a95c-91e6-45d5-9120-1aecf1156553.png" srcset="/img/loading.gif" lazyload alt="image"></p>
<h2 id="引入-Filebeat"><a href="#引入-Filebeat" class="headerlink" title="引入 Filebeat"></a>引入 Filebeat</h2><p><img src="https://files.mdnice.com/user/33721/ff035205-1100-4e01-ba30-7e3e311d24ee.png" srcset="/img/loading.gif" lazyload alt="image"></p>
<h1 id="安装-ELK"><a href="#安装-ELK" class="headerlink" title="安装 ELK"></a>安装 ELK</h1><h2 id="在-Docker-上搭建-ELK-Filebeat-日志中心"><a href="#在-Docker-上搭建-ELK-Filebeat-日志中心" class="headerlink" title="在 Docker 上搭建 ELK+Filebeat 日志中心"></a>在 Docker 上搭建 ELK+Filebeat 日志中心</h2><h3 id="启动-ElasticSearch"><a href="#启动-ElasticSearch" class="headerlink" title="启动 ElasticSearch"></a>启动 ElasticSearch</h3><p>可直接 docker run 模式启动,或使用<strong>docker-compose</strong> 模式</p>
<figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">docker</span> run -d -p <span class="hljs-number">9200</span>:<span class="hljs-number">9200</span> --name elasticsearch elasticsearch<br></code></pre></td></tr></table></figure>

<h3 id="启动-Logstash"><a href="#启动-Logstash" class="headerlink" title="启动 Logstash"></a>启动 Logstash</h3><p>可直接 docker run 模式启动,或使用<strong>docker-compose</strong> 模式,logstash 中可以自行创建 es 的 index 以及编写日志内容解析的 grok 语句</p>
<figure class="highlight puppet"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><code class="hljs puppet">1. 新建配置文件logstash.conf<br><span class="hljs-keyword">input</span> &#123;<br>beats &#123;<br><span class="hljs-attr">port</span> =&gt; <span class="hljs-number">5044</span><br>&#125;<br>&#125;<br><br><span class="hljs-keyword">output</span> &#123;<br>stdout &#123;<br><span class="hljs-attr">codec</span> =&gt; rubydebug<br>&#125;<br><span class="hljs-keyword">elasticsearch</span> &#123;<br><span class="hljs-comment">#填写实际情况elasticsearch的访问IP，因为是跨容器间的访问，使用内网、公网IP，不要填写127.0.0.1|localhost</span><br><span class="hljs-attr">hosts</span> =&gt; [<span class="hljs-string">&quot;&#123;<span class="hljs-variable">$ELASTIC_IP</span>&#125;:9200&quot;</span>]<br><br>&#125;<br>&#125;<br><br><span class="hljs-comment"># 2.启动容器，暴露并映射端口，挂载配置文件</span><br>docker run -d --expose 5044 -p 5044:5044 --name logstash -v <span class="hljs-string">&quot;<span class="hljs-variable">$PWD</span>&quot;</span>:/config-dir logstash -f /config-dir/logstash.conf<br></code></pre></td></tr></table></figure>

<h3 id="启动-Filebeat"><a href="#启动-Filebeat" class="headerlink" title="启动 Filebeat"></a>启动 Filebeat</h3><p>可直接 filebeat 文件 模式启动,或使用<strong>docker-compose</strong> 模式</p>
<figure class="highlight dts"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><code class="hljs dts"><span class="hljs-meta"># 1.下载Filebeat压缩包</span><br>wget https:<span class="hljs-comment">//artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.2.2-linux-x86_64.tar.gz</span><br><br><span class="hljs-meta"># 2.解压文件</span><br>tar -xvf filebeat<span class="hljs-number">-5.2</span><span class="hljs-number">.2</span>-linux-x86_64.tar.gz<br><br><span class="hljs-meta"># 3.新建配置文件filebeat.yml</span><br><span class="hljs-symbol">filebeat:</span><br><span class="hljs-symbol">prospectors:</span><br>- paths:<br>- <span class="hljs-keyword">/tmp/</span>test.log <span class="hljs-meta">#日志文件地址</span><br><span class="hljs-symbol">input_type:</span> log <span class="hljs-meta">#从文件中读取</span><br><span class="hljs-symbol">tail_files:</span> true <span class="hljs-meta">#以文件末尾开始读取数据</span><br><span class="hljs-symbol">output:</span><br><span class="hljs-symbol">logstash:</span><br><span class="hljs-symbol">hosts:</span> [<span class="hljs-string">&quot;&#123;$LOGSTASH_IP&#125;:5044&quot;</span>] <span class="hljs-meta">#填写logstash的访问IP</span><br><br><span class="hljs-meta"># 4.运行filebeat</span><br>./filebeat<span class="hljs-number">-5.2</span><span class="hljs-number">.2</span>-linux-x86_64/filebeat -e -c filebeat.yml<br></code></pre></td></tr></table></figure>

<h3 id="启动-Kibana"><a href="#启动-Kibana" class="headerlink" title="启动 Kibana"></a>启动 Kibana</h3><p>可直接 docker run 模式启动,或使用<strong>docker-compose</strong> 模式</p>
<figure class="highlight routeros"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs routeros">docker <span class="hljs-built_in">run</span> -d --name kibana -e <span class="hljs-attribute">ELASTICSEARCH_URL</span>=http://&#123;<span class="hljs-variable">$ELASTIC_IP</span>&#125;:9200 -p 5601:5601 kibana<br></code></pre></td></tr></table></figure>

<h1 id="测试"><a href="#测试" class="headerlink" title="测试"></a>测试</h1><figure class="highlight accesslog"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><code class="hljs accesslog">模拟日志数据<br><br># <span class="hljs-number">1</span>.创建日志文件<br>touch /tmp/test.log<br><br># <span class="hljs-number">2</span>.向日志文件中写入一条nginx访问日志<br>echo &#x27;<span class="hljs-number">127</span>.<span class="hljs-number">0</span>.<span class="hljs-number">0</span>.<span class="hljs-number">1</span> - - <span class="hljs-string">[13/Mar/2017:22:57:14 +0800]</span> <span class="hljs-string">&quot;<span class="hljs-keyword">GET</span> / HTTP/1.1&quot;</span> <span class="hljs-number">200</span> <span class="hljs-number">3700</span> <span class="hljs-string">&quot;-&quot;</span> <span class="hljs-string">&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36&quot;</span> <span class="hljs-string">&quot;-&quot;</span>&#x27; &gt;&gt; /tmp/test.log<br></code></pre></td></tr></table></figure>

<p>访问 http:&#x2F;&#x2F;{$KIBANA_IP}:5601</p>
<p><img src="https://files.mdnice.com/user/33721/9b2214e3-8be1-45d1-af9e-f74ee36b3b79.png" srcset="/img/loading.gif" lazyload alt="image"></p>
<p><img src="https://files.mdnice.com/user/33721/ea687f0a-86e2-437e-9aab-6536687f7c08.png" srcset="/img/loading.gif" lazyload alt="image"></p>
<p>生产环境中部署时，还需使用数据卷进行数据持久化，容器内存问题也需考虑，elasticsearch 与 logstash 都是相对吃内存的，如果不加以限制，很可能会拖垮你整个服务器。</p>
<h1 id="Python-日志接入-ELK"><a href="#Python-日志接入-ELK" class="headerlink" title="Python 日志接入 ELK"></a>Python 日志接入 ELK</h1><p>python 日志接入 ELK，主要问题是日志的格式解析，日常我们的 python 项目日志都是存储在 logs 目录下，根据 Python 程序的配置，分散到各个.log 文件。在程序部署使用 docker 或者 k8s 时，均可以通过挂载的方式，挂载到某一台宿主机上。我们的 Filebeat 可以配置读取相应的日志文件。再通过 Logstash 内配置内容解析，字段格式化等等操作，将非格式化的日志内容解析成结构化的数据，并详细解析不同的字段。</p>
<h2 id="Filebeat-配置"><a href="#Filebeat-配置" class="headerlink" title="Filebeat 配置"></a>Filebeat 配置</h2><figure class="highlight dts"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs dts"><span class="hljs-symbol">filebeat:</span><br><span class="hljs-symbol">  prospectors:</span><br>    -<br><span class="hljs-symbol">     paths:</span><br>       - <span class="hljs-keyword">/home/</span>***<span class="hljs-keyword">/logs/</span>app.log <span class="hljs-meta">#日志文件地址</span><br><span class="hljs-symbol">     input_type:</span> log <span class="hljs-meta">#从文件中读取</span><br></code></pre></td></tr></table></figure>

<h2 id="logstash-配置"><a href="#logstash-配置" class="headerlink" title="logstash 配置"></a>logstash 配置</h2><figure class="highlight puppet"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><code class="hljs puppet"><span class="hljs-keyword">input</span> &#123;<br>beats &#123;<br><span class="hljs-attr">port</span> =&gt; <span class="hljs-number">5044</span><br>&#125;<br>&#125;<br><span class="hljs-keyword">filter</span> &#123;<br>grok &#123;<br>    <span class="hljs-attr">match</span> =&gt; &#123; <span class="hljs-string">&quot;message&quot;</span> =&gt; <span class="hljs-string">&quot;%&#123;WORD:log_level&#125;:%&#123;DATA:log_message&#125;&quot;</span> &#125;<br>  &#125;<br>  <span class="hljs-keyword">grok</span> &#123;<br>    <span class="hljs-attr">match</span> =&gt; &#123; <span class="hljs-string">&quot;message&quot;</span> =&gt; <span class="hljs-string">&quot;Request: %&#123;TIMESTAMP_ISO8601:request_time&#125; %&#123;WORD:request_method&#125; %&#123;URIPATHPARAM:request_url&#125;&quot;</span> &#125;<br>  &#125;<br><br>&#125;<br><br><span class="hljs-keyword">output</span> &#123;<br>stdout &#123;<br><span class="hljs-attr">codec</span> =&gt; rubydebug<br>&#125;<br><span class="hljs-keyword">elasticsearch</span> &#123;<br><span class="hljs-comment">#填写实际情况elasticsearch的访问IP，因为是跨容器间的访问，使用内网、公网IP，不要填写127.0.0.1|localhost</span><br><span class="hljs-attr">hosts</span> =&gt; [<span class="hljs-string">&quot;es_ip:9200&quot;</span>]<br><span class="hljs-attr">index</span> =&gt; <span class="hljs-string">&quot;python-pro-%&#123;+YYYY.MM.dd&#125;&quot;</span> <span class="hljs-comment">## 自定义es的index</span><br>&#125;<br>&#125;<br></code></pre></td></tr></table></figure>

<h2 id="访问-Kibana："><a href="#访问-Kibana：" class="headerlink" title="访问 Kibana："></a>访问 Kibana：</h2><p>打开浏览器，访问 Kibana 的 Web 界面（默认地址为<a href="http://localhost:5601）。">http://localhost:5601）。</a><br>在 Kibana 中，创建一个新的索引模式，选择刚刚配置的索引名称（例如”python-pro-“）。<br>现在你可以在 Kibana 中查看和分析你的 Python 项目日志了</p>
<p><img src="https://files.mdnice.com/user/33721/eab67f8a-9ad2-40c1-8807-9dcc9bec58dd.png" srcset="/img/loading.gif" lazyload alt="image"></p>

                
              </div>
            
            <hr/>
            <div>
              <div class="post-metas my-3">
  
    <div class="post-meta mr-3 d-flex align-items-center">
      <i class="iconfont icon-category"></i>
      

<span class="category-chains">
  
  
    
      <span class="category-chain">
        
  <a href="/categories/%E6%A1%86%E6%9E%B6/" class="category-chain-item">框架</a>
  
  

      </span>
    
  
</span>

    </div>
  
  
    <div class="post-meta">
      <i class="iconfont icon-tags"></i>
      
        <a href="/tags/%E6%A1%86%E6%9E%B6/" class="print-no-link">#框架</a>
      
    </div>
  
</div>


              
  

  <div class="license-box my-3">
    <div class="license-title">
      <div>如何将Python项目日志接入到ELK</div>
      <div>http://blog.xhweng.cn/2025/02/11/如何将Python项目日志接入到ELK/</div>
    </div>
    <div class="license-meta">
      
        <div class="license-meta-item">
          <div>作者</div>
          <div>xuehaoweng</div>
        </div>
      
      
        <div class="license-meta-item license-meta-date">
          <div>发布于</div>
          <div>2025年2月11日</div>
        </div>
      
      
      
        <div class="license-meta-item">
          <div>许可协议</div>
          <div>
            
              
              
                <a class="print-no-link" target="_blank" href="https://creativecommons.org/licenses/by/4.0/">
                  <span class="hint--top hint--rounded" aria-label="BY - 署名">
                    <i class="iconfont icon-by"></i>
                  </span>
                </a>
              
            
          </div>
        </div>
      
    </div>
    <div class="license-icon iconfont"></div>
  </div>



              
                <div class="post-prevnext my-3">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2025/02/11/Redis%EF%BC%9A%E9%87%8A%E6%94%BE%E9%97%AA%E7%94%B5%E8%88%AC%E5%BF%AB%E9%80%9F%E7%9A%84%E6%95%B0%E6%8D%AE%E5%AD%98%E5%82%A8%E5%92%8C%E6%A3%80%E7%B4%A2%E8%83%BD%E5%8A%9B/" title="Redis：释放闪电般快速的数据存储和检索能力">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">Redis：释放闪电般快速的数据存储和检索能力</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2025/02/11/%E4%B8%BA%E4%BB%80%E4%B9%88%E9%80%89%E6%8B%A9FastAPI/" title="为什么选择FastAPI">
                        <span class="hidden-mobile">为什么选择FastAPI</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>

    <div class="side-col d-none d-lg-block col-lg-2">
      
  <aside class="sidebar" style="margin-left: -1rem">
    <div id="toc">
  <p class="toc-header">
    <i class="iconfont icon-list"></i>
    <span>目录</span>
  </p>
  <div class="toc-body" id="toc-body"></div>
</div>



  </aside>


    </div>
  </div>
</div>





  



  



  



  



  







    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v" for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>

    

    
  </main>

  <footer>
    <div class="footer-inner">
  
    <div class="footer-content">
       <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
    </div>
  
  
    <div class="statistics">
  
  

  
    
      <span id="busuanzi_container_site_pv" style="display: none">
        总访问量 
        <span id="busuanzi_value_site_pv"></span>
         次
      </span>
    
    
      <span id="busuanzi_container_site_uv" style="display: none">
        总访客数 
        <span id="busuanzi_value_site_uv"></span>
         人
      </span>
    
    
  
</div>

  
  
    <!-- 备案信息 ICP for China -->
    <div class="beian">
  <span>
    <a href="http://beian.miit.gov.cn/" target="_blank" rel="nofollow noopener">
      皖ICP备2024038809号-2
    </a>
  </span>
  
    
      <span>
        <a
          href="http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=12345678"
          rel="nofollow noopener"
          class="beian-police"
          target="_blank"
        >
          
            <span style="visibility: hidden; width: 0">|</span>
            <img src="/img/police_beian.png" srcset="/img/loading.gif" lazyload alt="police-icon"/>
          
          <span>京公网安备12345678号</span>
        </a>
      </span>
    
  
</div>

  
  
</div>

  </footer>

  <!-- Scripts -->
  
  <script  src="https://lib.baomitu.com/nprogress/0.2.0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://lib.baomitu.com/nprogress/0.2.0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://lib.baomitu.com/jquery/3.6.4/jquery.min.js" ></script>
<script  src="https://lib.baomitu.com/twitter-bootstrap/4.6.1/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>


  <script  src="https://lib.baomitu.com/typed.js/2.0.12/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var subtitle = document.getElementById('subtitle');
      if (!subtitle || !typing) {
        return;
      }
      var text = subtitle.getAttribute('data-typed-text');
      
        typing(text);
      
    })(window, document);
  </script>




  
    <script  src="/js/img-lazyload.js" ></script>
  




  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/tocbot/4.20.1/tocbot.min.js', function() {
    var toc = jQuery('#toc');
    if (toc.length === 0 || !window.tocbot) { return; }
    var boardCtn = jQuery('#board-ctn');
    var boardTop = boardCtn.offset().top;

    window.tocbot.init(Object.assign({
      tocSelector     : '#toc-body',
      contentSelector : '.markdown-body',
      linkClass       : 'tocbot-link',
      activeLinkClass : 'tocbot-active-link',
      listClass       : 'tocbot-list',
      isCollapsedClass: 'tocbot-is-collapsed',
      collapsibleClass: 'tocbot-is-collapsible',
      scrollSmooth    : true,
      includeTitleTags: true,
      headingsOffset  : -boardTop,
    }, CONFIG.toc));
    if (toc.find('.toc-list-item').length > 0) {
      toc.css('visibility', 'visible');
    }

    Fluid.events.registerRefreshCallback(function() {
      if ('tocbot' in window) {
        tocbot.refresh();
        var toc = jQuery('#toc');
        if (toc.length === 0 || !tocbot) {
          return;
        }
        if (toc.find('.toc-list-item').length > 0) {
          toc.css('visibility', 'visible');
        }
      }
    });
  });
</script>


  <script src=https://lib.baomitu.com/clipboard.js/2.0.11/clipboard.min.js></script>

  <script>Fluid.plugins.codeWidget();</script>


  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/anchor-js/4.3.1/anchor.min.js', function() {
    window.anchors.options = {
      placement: CONFIG.anchorjs.placement,
      visible  : CONFIG.anchorjs.visible
    };
    if (CONFIG.anchorjs.icon) {
      window.anchors.options.icon = CONFIG.anchorjs.icon;
    }
    var el = (CONFIG.anchorjs.element || 'h1,h2,h3,h4,h5,h6').split(',');
    var res = [];
    for (var item of el) {
      res.push('.markdown-body > ' + item.trim());
    }
    if (CONFIG.anchorjs.placement === 'left') {
      window.anchors.options.class = 'anchorjs-link-left';
    }
    window.anchors.add(res.join(', '));

    Fluid.events.registerRefreshCallback(function() {
      if ('anchors' in window) {
        anchors.removeAll();
        var el = (CONFIG.anchorjs.element || 'h1,h2,h3,h4,h5,h6').split(',');
        var res = [];
        for (var item of el) {
          res.push('.markdown-body > ' + item.trim());
        }
        if (CONFIG.anchorjs.placement === 'left') {
          anchors.options.class = 'anchorjs-link-left';
        }
        anchors.add(res.join(', '));
      }
    });
  });
</script>


  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/fancybox/3.5.7/jquery.fancybox.min.js', function() {
    Fluid.plugins.fancyBox();
  });
</script>


  <script>Fluid.plugins.imageCaption();</script>

  <script  src="/js/local-search.js" ></script>

  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





<!-- 主题的启动项，将它保持在最底部 -->
<!-- the boot of the theme, keep it at the bottom -->
<script  src="/js/boot.js" ></script>


  

  <noscript>
    <div class="noscript-warning">博客在允许 JavaScript 运行的环境下浏览效果更佳</div>
  </noscript>
</body>
</html>
